You give them your social security number, which is pretty easily leaked, basically.

if they think you're the target of identity theft they can step it up to requiring a PIN that they mail you?

Wow, that is .. quite some thing.

Here in Denmark we have MitID, which you kind of use for everything. Taxes, every private banking login (you switch banks, keep the login), signing documents, all kinds of healthcare websites and apps, student loans and what not.